reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Changed documentation and scan process

Browse Source
This commit is contained in:
Raj Chaudhuri committed 2024-03-03 16:12:27 +05:30
1 parent c1d3107418
commit 0e7b15b329
13 files changed
+262 -74
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

HISTORY.md
+44
View File
@@ -0,0 +1,44 @@
# History of the ReWeave project
## How it started
In June 2022, Weave Net had not been updated for a year. Problems were starting to appear in the field. In particular, the last published images on the Docker Hub ([weaveworks/weave-kube](https://hub.docker.com/r/weaveworks/weave-kube) and [weaveworks/weave-npc](https://hub.docker.com/r/weaveworks/weave-npc), v2.8.1) had issues supporting multiple processor architectures, and security scanners showed multiple vulnerabilities.
A call went out from Weaveworks to get the community more involved in maintaining it. After some discussion on GitHub issues and e-mail, and even a few online meetings, things were not moving forward.
## ReWeave begins
Finally, in March 2023, this fork was created, with the following goals in mind:
* Update dependencies, especially ones with security vulnerabilities
* Make minimal code changes _only_ when required by updating dependencies
* Create true multi-arch images using modern tools
* Create a new build process to automate all this
* Do all this with _minimal_ changes to the existing codebase. Keep all new things in the `reweave` folder.
These goals were achieved. Details can be found in the [reweave](reweave/README.md) directory. A [pull request](https://github.com/weaveworks/weave/pull/3996) was submitted on the weaveworks repo, with the aim of getting a new official release out.
## Weaveworks ends
On February 5th, 2024, Weaveworks CEO Alexis Richardson announced via [LinkedIn](https://www.linkedin.com/posts/richardsonalexis_hi-everyone-i-am-very-sad-to-announce-activity-7160295096825860096-ZS67/) and [Twitter](https://twitter.com/monadic/status/1754530336120140116) that Weaveworks is winding down.
So, a decision was taken to maintain this fork independently.
## We're forked
Two major changes were introduced at this point:
* The module name was changed to `github.com/rajch/weave` (previously `github.com/weaveworks/weave`)
* The default registry account for publishing images was changed to `docker.io/rajchaudhuri` (previously `docker.io/weaveworks`)
In addition, the old repo structure and codebase is not longer sacrosanct. Things can be moved around, new code can be added outside the `reweave` directory, old code can be modified or deleted as necessary.
The version numbers will continue from where Weaveworks left off.
## New Goals
The old goals, listed above (except the last one), remain the priority. In addition, this project aims to:
* Remove dependencies on Weaveworks infrastructure, starting with telemetry (what weaveworks called checkpoint)
* Publish new releases regularly, duly security scanned
* Provide supporting infrastructure, such as weave's famous one-line installation, where possible
README.md
+17 -23
View File
@@ -1,36 +1,30 @@
# ReWeave - an effort to keep Weave Net alive # ReWeave - an effort to keep Weave Net alive
This repository contains a fork of Weave Net, the first product developed by Weaveworks. This repository contains a fork of Weave Net, the first product developed by Weaveworks. Since Weaveworks has shut down, this repo aims to continue maintaining Weave Net, and to publish releases regularly.
## About Weaveworks [![Go Report Card](https://goreportcard.com/badge/github.com/rajch/weave)](https://goreportcard.com/report/github.com/rajch/weave)
[![Docker Pulls](https://img.shields.io/docker/pulls/rajchaudhuri/weave-kube)](https://hub.docker.com/r/rajchaudhuri/weave-kube)
![GitHub release (latest by date)](https://img.shields.io/github/v/release/rajch/ttws?include_prereleases)
[![Unique vulnerability count in all images](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Frajch%2Fweave%2Fmaster%2Freweave%2Fscans%2Fbadge.json&label=Vulnerabilty%20count)](reweave/scans/report.md)
Weaveworks created many innovative products and services around containers, Kubernetes and the cloud. They were pioneers in CNI networking and GitOps. The history of the ReWeave effort can be found in [HISTORY.md](HISTORY.md).
## Weave Net ## Using Weave on Kubernetes
Weave Net creates a virtual network that connects containers across multiple hosts and enables their automatic discovery. With Weave Net, portable microservices-based applications consisting of multiple containers can run anywhere: on one host, multiple hosts or even across cloud providers and data centers. Applications use the network just as if the containers were all plugged into the same network switch, without having to configure port mappings, ambassadors or links. Weave Net is also available as a CNI plugin, which allows it to provide container networking on Kubernetes clusters. On a newly created Kubernetes cluster, the Weave Net CNI pluging can be installed by running the following command:
## History of the ReWeave project ```
kubectl apply -f https://reweave.azurewebsites.net/k8s/v1.28/net.yaml
```
In June 2022, Weave Net had not been updated for a year. Problems were starting to appear in the field. In particular, the last published images on the Docker Hub had issues supporting multiple processor architectures, and security scanners showed multiple vulnerabilities. Replace `v1.28` with the version on Kubernetes on your cluster.
A call went out from Weaveworks to get the community more involved in maintaining it. After some discussion on GitHub issues and e-mail, and even a few online meetings, things were not moving forward. Finally, in March 2023, this fork was created, with the following goals in mind: That endpoint is provided by the companion project [weave-endpoint](https://github.com/rajch/weave-endpoint).
* Update dependencies, especially ones with security vulnerabilities ## Building Weave
* Make minimal code changes _only_ when required by updating dependencies
* Create true multi-arch images using modern tools
* Create a new build process to automate all this
These goals were achieved. Details can be found in the [reweave](reweave/README.md) directory. A pull request was submitted on the weaveworks repo, with the aim of getting a new official release out. Details can be found [here](reweave/BUILDING.md).
On February 5th, 2024, Weaveworks CEO Alexis Richardson announced via [LinkedIn](https://www.linkedin.com/posts/richardsonalexis_hi-everyone-i-am-very-sad-to-announce-activity-7160295096825860096-ZS67/) and [Twitter](https://twitter.com/monadic/status/1754530336120140116) that Weaveworks is winding down. ## Documentation status
So, this fork will now be maintained independently. At this point, any information found in directories other than `reweave`, such as `docs` or `site`, should be considered obsolete. In time, those will be updated.
## New Goals
The old goals, listed above, remain the priority. In addition, this project aims to:
* Remove dependencies on Weaveworks infrastructure, starting with telemetry
* Publish new releases regularly
* Provide supporting infrastructure, such as weave's famous one-line installation, where possible
reweave/CHANGELOG.md
+7
View File
@@ -6,6 +6,13 @@ All changes made to the weave net codebase during the reweave effort will be doc
### Changed ### Changed
* Vulnerability scanning output changed to a consolidated report
* Documentation changed to reflect new fork status
## 2.8.2-beta13 (c1d31074)
### Changed
* Module name changed to `github.com/rajch/weave` * Module name changed to `github.com/rajch/weave`
* Added environment variable `CHECKPOINT_DISABLE=1` to default manifests, to bypass weaveworks telemetry * Added environment variable `CHECKPOINT_DISABLE=1` to default manifests, to bypass weaveworks telemetry
reweave/Makefile
+1 -1
View File
@@ -1,4 +1,4 @@
IMAGE_VERSION ?= 2.8.2-beta13 IMAGE_VERSION ?= 2.8.2-beta14
REGISTRY_USER ?= rajchaudhuri REGISTRY_USER ?= rajchaudhuri
ALPINE_BASEIMAGE ?= alpine:3.19.1 ALPINE_BASEIMAGE ?= alpine:3.19.1
reweave/scans/badge.json
+1
View File
@@ -0,0 +1 @@
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "34", "color": "orange"}
reweave/scans/images-version.txt
-1
View File
@@ -1 +0,0 @@
Image version: 2.8.2-beta12
reweave/scans/report.md
+94
View File
@@ -0,0 +1,94 @@
# Vulnerability Report
Report date: 2024-03-03
Unique vulnerability count: 34
Images version: 2.8.2-beta14
## Scanner Details
Application: grype
Version: 0.74.7
BuildDate: 2024-02-26T18:24:14Z
GitCommit: 987238519b8d6e302130ab715f20daed6634da68
GitDescription: v0.74.7
Platform: linux/amd64
GoVersion: go1.21.7
Compiler: gc
Syft Version: v0.105.1
Supported DB Schema: 5
## Vulnerabilities
weave-kube: (34)
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium
libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.20.2 go-module CVE-2023-29405 Critical
stdlib go1.20.2 go-module CVE-2023-29404 Critical
stdlib go1.20.2 go-module CVE-2023-29402 Critical
stdlib go1.20.2 go-module CVE-2023-24540 Critical
stdlib go1.20.2 go-module CVE-2023-24538 Critical
stdlib go1.20.2 go-module CVE-2023-45285 High
stdlib go1.20.2 go-module CVE-2023-44487 High
stdlib go1.20.2 go-module CVE-2023-39325 High
stdlib go1.20.2 go-module CVE-2023-39323 High
stdlib go1.20.2 go-module CVE-2023-29403 High
stdlib go1.20.2 go-module CVE-2023-29400 High
stdlib go1.20.2 go-module CVE-2023-24539 High
stdlib go1.20.2 go-module CVE-2023-24537 High
stdlib go1.20.2 go-module CVE-2023-24536 High
stdlib go1.20.2 go-module CVE-2023-24534 High
stdlib go1.20.2 go-module CVE-2023-39326 Medium
stdlib go1.20.2 go-module CVE-2023-39319 Medium
stdlib go1.20.2 go-module CVE-2023-39318 Medium
stdlib go1.20.2 go-module CVE-2023-29409 Medium
stdlib go1.20.2 go-module CVE-2023-29406 Medium
weave-npc: (32)
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.20.2 go-module CVE-2023-29405 Critical
stdlib go1.20.2 go-module CVE-2023-29404 Critical
stdlib go1.20.2 go-module CVE-2023-29402 Critical
stdlib go1.20.2 go-module CVE-2023-24540 Critical
stdlib go1.20.2 go-module CVE-2023-24538 Critical
stdlib go1.20.2 go-module CVE-2023-45285 High
stdlib go1.20.2 go-module CVE-2023-44487 High
stdlib go1.20.2 go-module CVE-2023-39325 High
stdlib go1.20.2 go-module CVE-2023-39323 High
stdlib go1.20.2 go-module CVE-2023-29403 High
stdlib go1.20.2 go-module CVE-2023-29400 High
stdlib go1.20.2 go-module CVE-2023-24539 High
stdlib go1.20.2 go-module CVE-2023-24537 High
stdlib go1.20.2 go-module CVE-2023-24536 High
stdlib go1.20.2 go-module CVE-2023-24534 High
stdlib go1.20.2 go-module CVE-2023-39326 Medium
stdlib go1.20.2 go-module CVE-2023-39319 Medium
stdlib go1.20.2 go-module CVE-2023-39318 Medium
stdlib go1.20.2 go-module CVE-2023-29409 Medium
stdlib go1.20.2 go-module CVE-2023-29406 Medium
reweave/scans/scanner-version.txt
-10
View File
@@ -1,10 +0,0 @@
Application: grype
Version: 0.65.1
Syft Version: v0.86.1
BuildDate: 2023-08-04T13:02:31Z
GitCommit: 078a6c5e9e6e9e6e1037da6dcf953623e7d38500
GitDescription: v0.65.1
Platform: linux/amd64
GoVersion: go1.19.11
Compiler: gc
Supported DB Schema: 5
reweave/scans/weave-kube-count-vulns.txt
-1
View File
@@ -1 +0,0 @@
weave-kube CVE Count: 13
reweave/scans/weave-kube-list-vulns.txt
+35 -15
View File
@@ -1,15 +1,35 @@
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium curl 8.5.0-r0 apk CVE-2024-0853 Medium
libuv 1.47.0-r0 apk CVE-2024-24806 High libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.20.2 go-module CVE-2023-29405 Critical
stdlib go1.20.2 go-module CVE-2023-29404 Critical
stdlib go1.20.2 go-module CVE-2023-29402 Critical
stdlib go1.20.2 go-module CVE-2023-24540 Critical
stdlib go1.20.2 go-module CVE-2023-24538 Critical
stdlib go1.20.2 go-module CVE-2023-45285 High
stdlib go1.20.2 go-module CVE-2023-44487 High
stdlib go1.20.2 go-module CVE-2023-39325 High
stdlib go1.20.2 go-module CVE-2023-39323 High
stdlib go1.20.2 go-module CVE-2023-29403 High
stdlib go1.20.2 go-module CVE-2023-29400 High
stdlib go1.20.2 go-module CVE-2023-24539 High
stdlib go1.20.2 go-module CVE-2023-24537 High
stdlib go1.20.2 go-module CVE-2023-24536 High
stdlib go1.20.2 go-module CVE-2023-24534 High
stdlib go1.20.2 go-module CVE-2023-39326 Medium
stdlib go1.20.2 go-module CVE-2023-39319 Medium
stdlib go1.20.2 go-module CVE-2023-39318 Medium
stdlib go1.20.2 go-module CVE-2023-29409 Medium
stdlib go1.20.2 go-module CVE-2023-29406 Medium
reweave/scans/weave-npc-count-vulns.txt
-1
View File
@@ -1 +0,0 @@
weave-npc CVE Count: 11
reweave/scans/weave-npc-list-vulns.txt
+33 -13
View File
@@ -1,13 +1,33 @@
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.20.2 go-module CVE-2023-29405 Critical
stdlib go1.20.2 go-module CVE-2023-29404 Critical
stdlib go1.20.2 go-module CVE-2023-29402 Critical
stdlib go1.20.2 go-module CVE-2023-24540 Critical
stdlib go1.20.2 go-module CVE-2023-24538 Critical
stdlib go1.20.2 go-module CVE-2023-45285 High
stdlib go1.20.2 go-module CVE-2023-44487 High
stdlib go1.20.2 go-module CVE-2023-39325 High
stdlib go1.20.2 go-module CVE-2023-39323 High
stdlib go1.20.2 go-module CVE-2023-29403 High
stdlib go1.20.2 go-module CVE-2023-29400 High
stdlib go1.20.2 go-module CVE-2023-24539 High
stdlib go1.20.2 go-module CVE-2023-24537 High
stdlib go1.20.2 go-module CVE-2023-24536 High
stdlib go1.20.2 go-module CVE-2023-24534 High
stdlib go1.20.2 go-module CVE-2023-39326 Medium
stdlib go1.20.2 go-module CVE-2023-39319 Medium
stdlib go1.20.2 go-module CVE-2023-39318 Medium
stdlib go1.20.2 go-module CVE-2023-29409 Medium
stdlib go1.20.2 go-module CVE-2023-29406 Medium
reweave/tools/scan-images.sh
+30 -9
View File
@@ -20,17 +20,38 @@ WEAVE_NPC_IMAGE="${REGISTRY_USER}/weave-npc:${IMAGE_VERSION}"
# Get directory of script file # Get directory of script file
a="/$0"; a="${a%/*}"; a="${a:-.}"; a="${a##/}/"; BINDIR=$(cd "$a"; pwd) a="/$0"; a="${a%/*}"; a="${a:-.}"; a="${a##/}/"; BINDIR=$(cd "$a"; pwd)
mkdir -p "${BINDIR}/../scans"
echo "Image version: ${IMAGE_VERSION}" >"${BINDIR}/../scans/images-version.txt" # Set scan directory
SCANDIR="${BINDIR}/../scans"
mkdir -p "${SCANDIR}"
grype version >"${BINDIR}/../scans/scanner-version.txt" # Scan images
grype "${WEAVE_KUBE_IMAGE}" --add-cpes-if-none >"${SCANDIR}/weave-kube-list-vulns.txt"
grype "${WEAVE_NPC_IMAGE}" --add-cpes-if-none >"${SCANDIR}/weave-npc-list-vulns.txt"
grype "${WEAVE_KUBE_IMAGE}" --add-cpes-if-none >"${BINDIR}/../scans/weave-kube-list-vulns.txt" UNIQUECOUNT=$(tail -n +2 -q "${SCANDIR}/weave-npc-list-vulns.txt" "${SCANDIR}/weave-kube-list-vulns.txt" | sort -u | wc -l)
grype "${WEAVE_NPC_IMAGE}" --add-cpes-if-none >"${BINDIR}/../scans/weave-npc-list-vulns.txt" BADGECOLOR="blue"
echo "weave-kube CVE Count: $(tail +3 "${BINDIR}/../scans/weave-kube-list-vulns.txt" | wc -l)" \ if [ "$UNIQUECOUNT" -gt "0" ]; then
>"${BINDIR}/../scans/weave-kube-count-vulns.txt" BADGECOLOR="orange"
fi
echo "weave-npc CVE Count: $(tail +3 "${BINDIR}/../scans/weave-npc-list-vulns.txt" | wc -l)" \ # Produce report
>"${BINDIR}/../scans/weave-npc-count-vulns.txt" printf "# Vulnerability Report\n\n" > "${SCANDIR}/report.md"
{
printf "Report date: %s\n" "$(date +'%Y-%m-%d')"
printf "Unique vulnerability count: %s\n" "${UNIQUECOUNT}"
#tail -n +2 -q "${SCANDIR}/weave-npc-list-vulns.txt" "${SCANDIR}/weave-kube-list-vulns.txt" | sort -u | wc -l
printf "Images version: %s\n" "${IMAGE_VERSION}"
printf "\n## Scanner Details\n\n"
grype version
printf "\n## Vulnerabilities\n\nweave-kube: (%s) \n\n" "$(tail +2 "${SCANDIR}/weave-kube-list-vulns.txt" | wc -l)"
cat "${SCANDIR}/weave-kube-list-vulns.txt"
printf "\nweave-npc: (%s)\n\n" "$(tail +2 "${SCANDIR}/weave-npc-list-vulns.txt" | wc -l)"
cat "${SCANDIR}/weave-npc-list-vulns.txt"
} >> "${SCANDIR}/report.md"
# Produce Vulnerability Count badge json for README
cat <<EOBADGE > "${SCANDIR}/badge.json"
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "${UNIQUECOUNT}", "color": "${BADGECOLOR}"}
EOBADGE